Skip to content
Fencer Vulns
critical 9.8

CVE-2020-12017 json

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05.

published 2020-06-02 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4333

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.

Patch / fix

  • ge rt430_firmware 08a05
  • ge rt431_firmware 08a05
  • ge rt434_firmware 08a05

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-154-05 updated cvss 9.6

GE Grid Solutions Reason RT Clocks

  • General Electric (GE) RT430 RT431 and RT434 < 08A05
    affected: mitigation “GE strongly recommends users of time synchronization products update their units to firmware Version 08A05 or greater to resolve these issues.” gegridsolutions.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:N/C:P/I:P/A:C

Affected products

  • n/a GE Grid Solutions Reason RT Clocks

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.